Palo Alto Network Prisma Cloud

Palo Alto Networks Prisma Cloud is a comprehensive cloud-native application protection platform (CNAPP) that provides security, compliance, and governance across multi-cloud and hybrid environments. It delivers unified security for applications, data, and infrastructure throughout the entire development lifecycle and runtime environments.

Category	Vulnerability management
Direction	Query source
Sign-in	Access Key, JSON Web Token
Query languages	SQLite
Tables	26
Website	paloaltonetworks.com

Before you start

Huntbase can sign in to Palo Alto Network Prisma Cloud with any of these methods: Access Key, JSON Web Token. Pick one, create the credential in Palo Alto Network Prisma Cloud, then keep it to hand for the Connect step.

Access Key

Prisma Cloud access key ID (username) and secret key (password).

1. Sign in to Prisma Cloud with a user that has API access and a read-only role, such as Account Group Read Only. The access key is tied to the role you are logged in with.
2. Select Settings › Access Control › Access Keys, then Add › Access Key. If you don't see the option, you don't have permission to create access keys.
3. Enter a Name, set the Key Expiry, and click Create.
4. Copy or download the Access Key ID and Secret Key. You can't view the secret key again after you close the window.

Permissions:

• Account Group Read Only, which can view designated sections of Prisma Cloud but can't modify settings.

Watch out for

• By default only the System Admin has API access. An admin may need to enable API access for your user first.
• Deleting a role automatically deletes its access keys, which breaks the connection.

For the vendor's own instructions, see Prisma Cloud access key documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Palo Alto Network Prisma Cloud

1. Go to Connections and click New connection, or click New connection on the Palo Alto Network Prisma Cloud product page.
2. On Product, pick Palo Alto Network Prisma Cloud and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your Palo Alto Network Prisma Cloud lives:

Field	Required	Notes
API URL	Yes	Your API URL without the protocol. Replace app with api in your console URL, so https://app.eu.prismacloud.io becomes api.eu.prismacloud.io.
Customer Name	No
Protocol	No	One of https, http. Defaults to https.
Port	No
Timeout (seconds)	No
Skip SSL Certificate Verification	No
Logging Settings	No
Disable Reconnect	No
Max Retries	No
Max Retry Delay (ms)	No
Retries	No

Credentials

Choose a Method, enter a Credential label (for example Production), then fill in the fields for that method.

Access Key

Field	Required	Notes
Username (Access Key ID)	Yes	The Access Key ID. Secret — not shown again after you save it.
Password (Secret Key)	Yes	The Secret Key. Secret — not shown again after you save it.

JSON Web Token

Field	Required	Notes
JSON Web Token	Yes	Secret — not shown again after you save it.

Query it

Once connected, Palo Alto Network Prisma Cloud can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL over the 26 tables listed below, alongside every other connected source.

Tables

Palo Alto Network Prisma Cloud adds 26 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 26 tables

Table	Contains
prismacloud_account	List all cloud accounts onboarded onto the Prisma Cloud platform.
prismacloud_alert	List all information for prima cloud alerts.
prismacloud_alert_rule	List all information for prima cloud alert rules.
prismacloud_compliance_breakdown_requirement_summary	List all available compliance breakdown requirement summary.
prismacloud_compliance_breakdown_statistic	List all available compliance breakdown statistics.
prismacloud_compliance_breakdown_summary	List all available compliance breakdown summary.
prismacloud_compliance_requirement	List all available compliance requirement.
prismacloud_compliance_standard	List all available compliance standard.
prismacloud_iam_permission	List all available permission for the accounts.
prismacloud_iam_role	List all available roles for the users.
prismacloud_iam_user	List all available users and service accounts.
prismacloud_inventory_api_endpoint	Query Prisma Cloud inventory API endpoint.
prismacloud_inventory_asset_explorer	Prisma Cloud inventory asset explorer.
prismacloud_inventory_asset_view	Prisma Cloud inventory asset view.
prismacloud_inventory_workload	Prisma Cloud inventory workload summary.
prismacloud_inventory_workload_container_image	Query Prisma Cloud inventory workload container image.
prismacloud_inventory_workload_host	Prisma Cloud inventory workload host.
prismacloud_permission_group	List of available permission groups.
prismacloud_policy	List of available policies in Prisma Cloud.
prismacloud_prioritized_vulnerability	Returns the top-priority vulnerabilities which are aggregated based on the most urgent, exploitable, patchable, and vulnerable packages in use along with the number of assets they occur in.
prismacloud_report	List of available alert and compliance reports.
prismacloud_resource	List of available resources in Prisma Cloud.
prismacloud_trusted_alert_ip	List of trusted alert IPs in Prisma Cloud.
prismacloud_vulnerability_asset	The asset summary of vulnerability.
prismacloud_vulnerability_burndown	The burndown summary of vulnerability.
prismacloud_vulnerability_overview	Provides an overview summary of vulnerabilities in the environment.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog